Regulating Internet Privacy

PAUL SOLMAN: Okay. What, if anything, should be done to ensure privacy online? We discuss that now with Christine Varney, a member of the Federal Trade Commission; Martin Haeberli, director of technology for Netscape Communications; Tim Davies, chief operating officer at the database company Lexis-Nexis; and David Sobel, legal counsel for the Electronic Privacy Information Center.

Welcome to you all. Mr. Sobel, what is the basic problem here?

DAVID SOBEL, Electronic Privacy Information Center: Well, I think that privacy has now become probably the most significant consumer rights issue that we're facing as a society.

PAUL SOLMAN: Really? You mean literally the most important?

DAVID SOBEL: I think it is. We have now moved into an information economy, and what we're seeing is that personal information--sometimes intimate, sensitive facts about people's lives--are become a commodity, and this information is being bought and sold, and, unfortunately, the subjects of this information, the consumers who generate this information through their transactions or through their activities on the Internet have no control over the use of this information. And they frequently are not even aware of the fact that the information is being collected.

PAUL SOLMAN: How does this stuff all get into the Internet or get out there?

DAVID SOBEL: I think there are a variety of ways. As the introductory piece mentioned, there's magazine subscription information; there is the Social Security number, which is a significant piece of personal information that's bought and sold; there is a myriad of sources of this information. And the individual really has no way of knowing where it's coming from, or what's happening to it.

PAUL SOLMAN: Commissioner Varney, you're nodding your head as he's talking. You also think this is a really big deal.

CHRISTINE VARNEY, Federal Trade Commission: I think it is. I think that privacy is emerging as probably one of the key consumer protection issues in the next century in the information age. You know, people today have a realistic understanding of what information is being collected about them when they go into a bookstore. You buy a book; you're maybe a frequent buyer-member, you use a credit card; and at my bookstore, after I buy ten/fifteen books, I get a discount. That's great. But nobody follows me around and writes down what books I'm looking at, what pages I'm looking at, how long I look at it, and when I put it back. And I think that there is an opportunity here for industry to educate consumers and to give consumers notice and choice, but there's also an opportunity for a lot of bad actors to collect and sell information.

PAUL SOLMAN: So what are the specific issues? There are a number of them that the introductory piece had. And we've heard about sort of a general problem.

COMMISSIONER CHRISTINE VARNEY: Right.

PAUL SOLMAN: But what are the specific problems, and where do they happen?

COMMISSIONER CHRISTINE VARNEY: Right. Well, I think that there's one set of problems that I think Mr. Davies will be able to address in the massive amounts of data that can now be easily aggregated, collected, aggregated, and sold. You know, since information has become electronic, as the opening piece said, you can get birth records, death records, property tax records, all kinds of public records, driver's records. You can take that information. You can then add on to it a variety of personal information and resell it. That's one area of the problem. The other area is when you're going on to the Internet, what information is being collected about you, what do you know about it, what can you do about it, and what rights do you have? And I think there's a big issue around children, the information that's being collected from and about children.

PAUL SOLMAN: Okay. So, Mr. Davies, from Lexis-Nexis, explain what your company does and how it might be put to the wrong use.

TIM DAVIES, Lexis-Nexis: (Cincinnati) Yes. Thank you very much. One point I would like to clear up initially is the general confusion which I fully understand, given the concerns on privacy generally, and the understanding of the public, and they need to understand the differences between the Internet and an online service such as Lexis-Nexis.

PAUL SOLMAN: Right.

TIM DAVIES: Your introductory comments made a whole number of issues, including marketing information, which Lexis-Nexis does not have, never had any intention of having, but it also goes on the fact we withdrew a service; we didn't withdraw a service. And we've always gone to great lengths to protect the consumer and also give the information, which the professionals who use our service need.

PAUL SOLMAN: But I could get information--

TIM DAVIES: If I could just--

PAUL SOLMAN: Please. I can get--I just want to know--I want to know if I can get information from Lexis-Nexis on the Internet. I mean, I can use my computer--

TIM DAVIES: No. Well, just to be absolutely clear, anybody that uses Lexis-Nexis has to register for Lexis-Nexis and always had to. That is a point that was obscured slightly initially.

PAUL SOLMAN: Well, is there no problem then?

TIM DAVIES: And in signing on, they have to sign agreements; they comply with the law, like the Fair Credit Information Act. We have to make certain--we have to satisfy ourselves in the business areas they're actually coming from, and only then do they have access to certain areas of our information. And they have to pay for that. That is very different from the consumer in the street coming into a database such as ours and just take the information.

PAUL SOLMAN: So is there no problem?

TIM DAVIES: I wouldn't say there's a problem. There's a lot of concern. But one of the points you didn't cover in your introduction, which was covered at great lengths yesterday, was all the many benefits with information such as ours that is used.

PAUL SOLMAN: For example.

TIM DAVIES: That's one of the biggest issues which is reported in the copy of [USA Today], is on aces, of child support, finding deadbeat dads. It is in our case in supporting the legal market--my daughter was in a car accident the other year--it takes a couple of years to get all the costs together and see what other damages come through--another couple of years before a court case. Witnesses have to be found, as well as witnesses have to be found, sometimes there are nice stories of a beneficiary to a will many years after the will has actually been written.

PAUL SOLMAN: Okay.

TIM DAVIES: All these things are very, very important in society and have very many benefits, all of which were acknowledged yesterday. And I should mention crime prevention.

PAUL SOLMAN: Okay. You have a proposal, though, with a number of other companies to self-regulate, do you not?

TIM DAVIES: We do, indeed.

PAUL SOLMAN: So you must think there's some problem, but what's the essence of the proposal? What are you trying to prevent?

TIM DAVIES: Well, in putting it through, one of the points that came out when we had the P-Trak incident last year was the general concern, particularly when misinformation is given out, and we, as a company, realize that the consumers as a whole needed to be educated and needed to be told very important aspects of the education side, as well as the education is what uses we actually do, the reliability of information. The fact that when we actually had the information up, such as P-Trak, that we don't displace, Social Security numbers, the birth information is month and year.

PAUL SOLMAN: And so that's the kind of regulation you're trying to put in as a group of companies.

TIM DAVIES: Yes. And that was agreed. I mean, some of the companies, like Lexis-Nexis, were doing the majority of these points already.

PAUL SOLMAN: Okay. Commissioner--

TIM DAVIES: The industry standard, I should say, has already had many benefits, such as an agreement on Social Security, none of which has already been put into effect.

PAUL SOLMAN: Commissioner Varney is trying to get in here, so, please, if you'd respond to that one, then we'll go to Mr. Haeberli about the Internet.

COMMISSIONER CHRISTINE VARNEY: I think it's important to point out that Lexis-Nexis has been a leader in the industry, and when there was--when it came to light that there was problems with their database, they quickly changed, and the standards that were presented yesterday I think were, in large part, due to the leadership from this company. But let me say that they raise the important questions in their proposed standards. They talk about what public data they will get, what they will use it for, under what circumstances they will sell it for commercial purposes, what access an individual has to his or her own records, and what they'll do with regard to children's information. Now, they raised the questions. They didn't go quite as far as I would like to see them go in answering them, and we're going to continue to work with them.

PAUL SOLMAN: Mr. Sobel, what do you think of the proposal that they've got out there?

DAVID SOBEL: Well, I think it's certainly a step in the right direction, but as your questions to Mr. Davies indicated, I think it reflects the fact that there is a problem. Mr. Davies talks about, and it was discussed at yesterday's hearing, the beneficial uses that there are of these personal locator services. But the point that I made at the hearing yesterday is that most of us are impacted by these--these kinds of databases by the fact that we're suddenly getting inundated with junk mail in our mailboxes, with unwanted telephone calls at home at dinnertime, and I think most of your viewers are feeling the effects of that much more than the so-called beneficial uses of these services.

PAUL SOLMAN: All right. Let's go to the Internet now. Mr. Haeberli, what does your company do, and how can what you're involved in be misused?

MARTIN HAEBERLI, Netscape Communication: (Mt. View, CA) Our company, Netscape Communications Corporation, designs, delivers, makes software both that sits on desktop computers next to end users, as well as server software that offers up Internet content to those users. And finally, also, it also authors and creates tools that help people create such content.

PAUL SOLMAN: Getting onto the Internet, for example, and getting around on it. That's what you guys do?

MARTIN HAEBERLI: Right. So this is basically--Netscape Communicator is our latest tool that helps end users and businesses surf Internet content. Now, what's happened today is that an unprecedented collaboration was announced between ourselves and our competitors, Microsoft, as well as a company called Firefly in Boston, to cooperate to collaborate to define and shape and build upon a proposal we made a few weeks ago in the privacy space. And our key principles really here are the end user should participate in the context of informed consent of value received, that is, only disclosed information that's necessary for the relationship with a site.

PAUL SOLMAN: How do you do that?

MARTIN HAEBERLI: Well, what we've done is we've defined a set of technical standards. We've proposed a set of technical standards that begin making possible, in conjunction with some business rules and some social practices, the possibility for an end user to enter the information about themselves they want into their own computer and explicitly control how, where, and when that is disclosed to other sites and services.

PAUL SOLMAN: And the problem right now is that these computers can go into my computer and track what I'm doing, is that the issue?

MARTIN HAEBERLI: Well, that's certainly one of the--that's certainly one of the concerns that's kind of a side effect of how things work now, is that today when you visit a site, say a newspaper site, and you enter information about yourself, like your favorite hobby, that information that is captured by the newspaper site you have no way of knowing how that's reused. Now, one partial solution for this is to store your favorite hobbies on your computer and store them securely. Another partial solution is only to disclose them to sites when you are aware of it, rather than implicitly. This is one challenge with the current technologies that are used. And so what our proposal, our open profiling standing proposal, does is begin--create a technical frame work where you could as an end user have an explicit exchange with an information service provider.

PAUL SOLMAN: And you can control it more?

MARTIN HAEBERLI: Yes. Right. The key point is that the owner of the information, the creator of the information, should have control of how and when it's used.

PAUL SOLMAN: Okay. So, Mr. Sobel, we're on the Internet now, and those problems--is this a good solution to that?

DAVID SOBEL: I think it's a positive sign that the industry is beginning to respond to the privacy issue.

PAUL SOLMAN: Are you impressed that it's Microsoft and Netscape together?

DAVID SOBEL: I was going to say that I think it indicates how significant this issue is, that they have managed to find common ground to address this problem. I think they probably recognize that this is for the greater good; that the privacy issue needs to be addressed. I think I'm going to reserve judgment on the benefits of the standard until I actually see a product and see how usable it is and how easy it is for a consumer and a user to make use of these features. But I do want to also say that I'm not convinced that a technological solution is necessarily the magic bullet that's going to solve all of our privacy problems. I think there is also some need for some legal protections.

PAUL SOLMAN: So Commissioner Varney, how do you react to this, besides also, I gather, being impressed with the fact that these big shots are getting together, or rivals are getting together, but how do you react to it as--

COMMISSIONER CHRISTINE VARNEY: As long as it's an open standard and anybody can participate.

PAUL SOLMAN: That's a different issue.

COMMISSIONER CHRISTINE VARNEY: Much the same as has been said. Consumers need privacy protections. Whether they get those privacy protections because there is easily-available software that enables them to make choices and control their information, or they get it because the government requires it remains to be seen. I think the most important thing that I can see in Microsoft and Netscape and Firefly coming together is a serious commitment to try and address the problem. So we'll see. The standard that's been proposed now goes into a technical committee to see if it can work on the Internet architecture, and there's all kinds of sort of very esoteric and technical questions about what's the default standard, what--what information is automatically given away about you without your knowledge or consent. So there's a lot of questions we've got to look at here.

PAUL SOLMAN: Mr. Davies, I wanted to get back to you. Government regulation, are you afraid that the government will go too far, and we'll lose some of those benefits you were talking about earlier?

TIM DAVIES: No. I'd put it a slightly different way. We enjoy working with the FTC, and we're fully aware of all the issues that need to be addressed, and pleased they're being discussed. The big issue that needs to be concerned is I feel that it's slightly dangerous if one rushes in too early into legislation, and legislation is very necessary in certain cases. We're in an industry that's moving extremely quickly in the technological age, and we need to be able to react to that. And I'd like to think that the standards that we've pulled together in the last really month or two, the fact that they've already taken immediate action and to benefits, which I think Mr. Sobel and others would agree, are working and are satisfactory, should be given a chance. And I think--

COMMISSIONER CHRISTINE VARNEY: Well, we don't know whether or not they're working and satisfactory because, as we discussed yesterday, Tim, there's no enforcement mechanism yet on these standards. And that's something that we've got to work on.

TIM DAVIES: Absolutely, Christine. And we look forward to working on that. The point I was trying to draw aim was the fact that the Social Security numbers, which is the major concern to consumers, an action has been taken which has already been put into effect.

PAUL SOLMAN: All right. Well, thank you all very much. Appreciate your coming in.